Regulatory and Industry Compliance CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational company is subject to a regulation that requires personal data of its customers to remain within the country where the customers reside. The company is planning to use a public cloud provider. What should the company do to satisfy this requirement?

   • AImplement a virtual private network (VPN) for all data transfers
   • BStore all data in the cloud provider's headquarters country
   • CSelect a cloud region located in the same country as the customers
   • DUse a cloud provider that offers encryption for data at rest
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A European e-commerce company stores customer personal data in a cloud database. The company's privacy team is concerned about GDPR compliance, especially regarding data transfers to non-EU countries. The cloud provider offers data centers in multiple regions, including the EU and the US. What should the company do to ensure GDPR-compliant data transfers?

   • AUse a US region for all data and rely on the cloud provider's privacy shield certification
   • BStore all personal data in an EU region and avoid any transfer of data to non-EU regions
   • CEncrypt all data before storing it in any region, including the US
   • DObtain consent from each customer to allow data transfer to the US
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   After mapping an organization's controls to a regulatory framework, the security team finds that several required controls are missing from the current cloud deployment. What does this finding represent?

   • AA security incident
   • BA risk appetite
   • CA compliance gap
   • DA control objective
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to reduce the manual effort required to maintain compliance with multiple regulatory standards. The company wants to use a tool that can continuously assess its cloud environment against these standards and provide a unified view of compliance. Which type of tool should the company use?

   • AA network intrusion detection system (NIDS)
   • BA cloud security posture management (CSPM) tool
   • CA vulnerability scanner
   • DA web application firewall (WAF)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is migrating a workload to the cloud and has identified that its current security controls do not fully satisfy the requirements of the regulatory framework it must follow. The compliance team needs to document the specific differences between the company's current controls and the required controls. Which activity should the team perform?

   • ACreate a disaster recovery plan
   • BConduct a gap analysis
   • CPerform a risk assessment
   • DImplement a data classification scheme
   Reveal Solution Discussion Select an answer first